Topic starter
07/06/2026 8:13 pm
TL;DR: Cyber Security Tribe’s annual state of the industry report says 40% of CISO executives are prioritising data security investments in 2024, using people, process, and technology as the benchmark for planning according to Cyera. That shift makes data security programme design a business planning issue, not just a tooling discussion.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “Cyber Security Tribe’s Annual State of the Industry Report”.
Key questions
Q: How should security teams prioritise data security investment in 2024?
A: Start with the data sets that carry the highest operational, regulatory or revenue impact, then map the controls needed to reduce exposure on those paths.
Q: What breaks when data security controls are managed separately across different teams and tools?
A: Fragmented management usually creates inconsistent policies, slower remediation, and blind spots around where sensitive data is exposed.
Q: What are the signs that a data security programme lacks operational maturity?
A: Common signs include unclear data ownership, inconsistent classification, duplicated controls across teams, and access paths that are not tied to specific data risks.
Practitioner guidance
- Define a data security investment model Tie planned spending to named business risks, protected data classes and decision owners so the budget conversation is anchored in outcomes rather than features.
- Map people, process and technology gaps Identify where ownership, escalation and control execution break down before adding more tooling, especially in classification and access workflows.
- Connect identity controls to data exposure paths Review how privileged users, service accounts and workload identities reach sensitive datasets, then prioritise the access paths that create the largest blast radius.
Bottom line: Data security is moving up the priority list because executives are treating it as a programme-level issue rather than a narrow technical concern.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
07/06/2026 10:03 pm
Data security has become a governance priority, not just a protection layer. When executives rank it alongside broader security planning, the discipline shifts from reactive control buying to portfolio allocation. That matters because data security now competes for budget with identity, cloud and endpoint programmes. The practitioner conclusion is that data security has to be managed as a board-visible risk domain, not a tactical subsystem.
A question worth separating out:
Q: Should data security or identity governance be addressed first?
A: Neither should be treated as independent if the same users, service accounts or workloads can reach sensitive data. Identity governance should establish who can access what, while data security should define what is worth protecting and monitoring. The right sequence is to align them around the highest-value data paths.
👉 Read our full editorial: State of the industry report shows data security rising in priority
This post was modified 3 days ago by NHI Mgmt Group